Article (Scientific journals)
Similarity testing for access control
Bertolino, A.; Daoudagh, S.; El Kateb, Donia et al.
2015In Information and Software Technology, 58, p. 355-372
Peer reviewed
 

Files


Full Text
Similarity testing for access control.pdf
Publisher postprint (2.68 MB)
Download

All documents in ORBilu are protected by a user license.

Send to



Details



Keywords :
Security policies; Similarity; Test prioritization; Budget control; Fault detection; Testing; Access control policies; Exhaustive testing; Mutation analysis; Security mechanism; Security policy; Similarity criteria; Access control
Abstract :
Context: Access control is among the most important security mechanisms, and XACML is the de facto standard for specifying, storing and deploying access control policies. Since it is critical that enforced policies are correct, policy testing must be performed in an effective way to identify potential security flaws and bugs. In practice, exhaustive testing is impossible due to budget constraints. Therefore the tests need to be prioritized so that resources are focused on their most relevant subset. Objective: This paper tackles the issue of access control test prioritization. It proposes a new approach for access control test prioritization that relies on similarity. Method: The approach has been applied to several policies and the results have been compared to random prioritization (as a baseline). To assess the different prioritization criteria, we use mutation analysis and compute the mutation scores reached by each criterion. This helps assessing the rate of fault detection. Results: The empirical results indicate that our proposed approach is effective and its rate of fault detection is higher than that of random prioritization. Conclusion: We conclude that prioritization of access control test cases can be usefully based on similarity criteria. © 2014 Elsevier B.V. All rights reserved.
Disciplines :
Computer science
Identifiers :
eid=2-s2.0-84914157978
Author, co-author :
Bertolino, A.;  Istituto di Scienza e Tecnologie dell'Informazione A. Faedo, Consiglio Nazionale Delle Ricerche, via G. Moruzzi 1, Pisa, Italy
Daoudagh, S.;  Istituto di Scienza e Tecnologie dell'Informazione A. Faedo, Consiglio Nazionale Delle Ricerche, via G. Moruzzi 1, Pisa, Italy
El Kateb, Donia ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > Computer Science and Communications Research Unit (CSC)
Henard, Christopher ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Le Traon, Yves ;  University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)
Lonetti, F.;  Istituto di Scienza e Tecnologie dell'Informazione A. Faedo, Consiglio Nazionale Delle Ricerche, via G. Moruzzi 1, Pisa, Italy
Marchetti, E.;  Istituto di Scienza e Tecnologie dell'Informazione A. Faedo, Consiglio Nazionale Delle Ricerche, via G. Moruzzi 1, Pisa, Italy
Mouelhi, T.;  Interdisciplinary Research Centre, SnT, University of Luxembourg, Luxembourg, Luxembourg
Papadakis, Mike ;  University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)
External co-authors :
yes
Language :
English
Title :
Similarity testing for access control
Publication date :
2015
Journal title :
Information and Software Technology
ISSN :
0950-5849
Publisher :
Elsevier
Volume :
58
Pages :
355-372
Peer reviewed :
Peer reviewed
Available on ORBilu :
since 03 April 2016

Statistics


Number of views
283 (24 by Unilu)
Number of downloads
424 (8 by Unilu)

Scopus citations®
 
21
Scopus citations®
without self-citations
11
OpenCitations
 
21
WoS citations
 
16

Bibliography


Similar publications



Contact ORBilu